Platform integrations & data use

say-vi publishes the videos you create to social accounts that youconnect. Each connection uses the platform's own OAuth dialog, so you sign in with the platform — never with say-vi — and grant access to your own account. We follow the same principles for every platform:

• Per-account, multi-tenant: you authorise your own account. say-vi never posts from a shared or platform-owned master account.
• Least privilege: we request only the scopes needed to identify the connected account and publish the videos you choose — nothing more.
• Server-side tokens: access and refresh tokens are held encrypted on the server and are never exposed to the browser.
• You stay in control: nothing is posted until you press Publish, and every video carries an AI-generated disclosure.
• Nothing passive: we do not read your feed, followers, messages or analytics, and we never post on a schedule or without your action.

Without provider keys a connection links a simulated account so the flow can be demonstrated end to end; with keys present it is the real OAuth dialog. You can disconnect any platform at any time from the in-app Connections page, which deletes the stored token, or revoke access from the platform's own settings (links in each section below).

Connecting opens Google's OAuth consent screen and grants say-vi permission to upload to your channel and read its basic identity. We request two scopes:

• https://www.googleapis.com/auth/youtube.upload — upload the videos you choose to your channel (videos.insert). This is the only write access; we cannot edit, list or delete anything else.
• https://www.googleapis.com/auth/youtube.readonly— read your channel's name and thumbnail so the Connections page can show which account is linked (channels.list mine=true).

Every upload sets the AI-generated disclosure (containsSyntheticMedia). Until the Google Cloud project passes OAuth verification, uploads are kept private regardless of the privacy you select. Your use of YouTube is governed by the YouTube Terms of Service and the Google Privacy Policy, and say-vi's use of Google user data adheres to the Google API Services User Data Policy, including the Limited Use requirements. Revoke access at any time from the Google security settings page.

Connecting uses TikTok Login Kit and grants two scopes so we can show your account and post on your behalf:

• user.info.basic — your display name and avatar for the connection card.
• video.publish — Direct Post a video through the Content Posting API.

An AI-generated content label is applied and TikTok's privacy selector is shown before anything is posted. Public posting requires TikTok's app review of the video.publishscope. Revoke access under TikTok → Settings → Security & permissions → Manage app permissions.

Connecting uses Login with Facebook. Instagram and Facebook share Meta's Graph API, so a single connection covers both. We request:

• public_profile — basic profile needed to complete login.
• pages_show_list — list the Facebook Pages you manage so you can choose one.
• pages_read_engagement — read basic information about the selected Page.
• pages_manage_posts — publish the video to your chosen Facebook Page.
• business_management — resolve the Business assets that link your Page and Instagram account.
• instagram_basic— read the linked Instagram professional account's identity.
• instagram_content_publish — publish Reels to that Instagram account.

The *_content_publish and pages_manage_posts permissions are Advanced Access, so they require Meta App Review and Business Verification before people outside your app roles can grant them. Revoke access under Facebook → Settings & privacy → Settings → Business Integrations.

Connecting uses OAuth 2.0 with PKCE and grants the scopes needed to attach a video and post a tweet as you:

• tweet.read — read the context required to post.
• tweet.write — post the tweet with your video attached.
• users.read — read your @handle and identity for the connection card.
• media.write — upload the video (chunked) to attach to the tweet.
• offline.access — issue a refresh token so say-vi can post at publish time without asking you to reconnect each time.

The tweet copy always includes an AI-generated disclosure. Revoke access under X → Settings → Security and account access → Apps and sessions → Connected apps.

Across every platform, connection tokens are stored encrypted on the server, are never sent to the browser, and are refreshed before expiry where the platform supports it. We use these APIs only to (a) show which account is connected and (b) publish content you explicitly choose to publish.

You can disconnect a platform at any time from the in-app Connections page, which removes the stored token, or revoke say-vi from the platform's own settings using the links in each section above. For the full picture of what we collect and why, see our Privacy Policy.